I’m Christian. For ten plus years I’ve worked where IT operations and security meet: keeping enterprise systems running, keeping them defensible, and staying steady on the call when something big breaks.
Why operations and security
Two tracks have run side by side for my whole career: keeping environments operating, and keeping them defensible. Most of my roles have asked for both at once, and the ones that only asked for one were the exception.
Operations leadership and security operations draw on the same instincts: triage under pressure, clear ownership, and evidence that holds up. I’ve been trusted with both, and I keep both current: the lab for hands-on work on Microsoft’s security stack, the SSCP and CISSP for the breadth across risk and compliance.
The dates, titles, and details are on my resume. This page is about how I work, and who I am outside of it.
How I work
A finding is only as useful as the owner it reaches.
At TelevisaUnivision, my part of the program came after the scan: tracing each finding to the team that owned the system and following exception requests through to a decision. At Toyota, the same discipline carried into cloud audits, where misconfigurations stayed on my list until they were closed.
The underrated part of an incident is the review afterward.
For over five years I assigned severity, coordinated the response, and decided when to escalate when production went down. The work that lasts is the post-incident review that stops the same failure from paging anyone again.
The same outage has three versions.
Engineers need the technical picture, executives need the business impact and a restoration estimate, and the service desk needs something it can actually say. Audits work the same way. Getting each version right is most of the job in any senior role.
A good team spends its time on what matters.
Five engineers, a shared backlog, an on-call rotation, and SLA commitments somebody is measuring. The job is triage discipline, clear ownership, and removing the recurring noise.
Uptime and exposure are the same conversation.
A rushed change can become the next outage, and an expired certificate or a stale DNS record can become the next incident. I treat change windows, certificates, and cloud permissions as one discipline, not two.
Off the clock
I’ve known my beautiful wife for quite a while, and winning her over took longer than any incident I ever managed. Once I finally did, we dated for four years, and as of 2026 we’ve been happily married for more than three. We recently welcomed our son, and I am grateful to the Lord Jesus Christ for blessing us with him.
The house is rarely quiet. Two doodles run the place, along with a parrot that talks, at least when it isn’t busy inventing new sounds and dialects.
Where we live, natural springs are never far away. When the Florida heat and humidity settle in, a cold, clear spring is the best part of the weekends, and it hasn’t gotten old yet.
If the parrot ever learns a new word worth sharing, you’ll hear about it here first.
What you’ll find here
The Homelab page is the Microsoft security lab I’m building: Defender XDR, Sentinel and Purview on an Entra ID foundation, with sanitized configs and playbooks landing on GitHub as the build grows.